From set-up to action

So far in Risk Essentials we’ve covered ISO 31000’s principles (what good looks like) and its framework (how an organisation sets itself up). The process is where the work happens. It’s the set of steps people follow, again and again, to find risks, understand them, decide what to do, and keep track.

The process isn’t only for the risk department. It works for a board decision, a new project, a supplier contract or a single team’s plan. The steps are the same; only the scale changes.

In our football club example, if the framework is the club, the process is how the club plays each match: study the opponent, pick the team, play, watch what happens and adjust at half-time.

The six steps of the process

The heart of the process is three steps in a row: set the scope, context and criteria, do the risk assessment, then treat the risk. Around them run three steps that never stop: communication and consultation, monitoring and review, and recording and reporting.

1. Communication and consultation, all the way through. Talking to and listening to the people who are affected by the risk or know something about it, at every step, not just at the end.

• Working: the people who do the work help identify the risks, and decision-makers hear bad news early.
• Warning sign: the risk assessment is written by one person at a desk and sent out for “noting”.

2. Scope, context and criteria. Before looking for risks, be clear about what you’re assessing and why. What’s the objective? What’s in and out of scope? What’s going on inside and outside the organisation? And what are the risk criteria: how will you decide whether a risk is big or small, and how much is acceptable? The criteria should follow the risk appetite set in the framework.

• Working: everyone uses the same rating scales, and they’re linked to the risk appetite.
• Warning sign: each team rates risks its own way, so “high” means something different in every report.

3. Risk assessment, in three parts.

• Identify: find, recognise and describe the risks that could help or stop you from achieving the objective. Look at causes, events and consequences, and include opportunities, not only threats.
• Analyse: understand each risk: what causes it, how likely it is, how bad the consequences could be, and how well the current controls work.
• Evaluate: compare the results with the risk criteria to decide which risks need action, and in what order.
• Working: the assessment changes a decision, a budget or a plan.
• Warning sign: the same ten risks are copied from last year, with the same ratings.

4. Risk treatment. Choosing and putting in place the right response. Options include avoiding the risk by not going ahead; removing its source; reducing how likely it is or how bad it would be; sharing it, for example through insurance or a contract; accepting it as an informed decision; or even taking on more risk to pursue an opportunity. Each treatment needs an owner, resources and a deadline, and you check what risk is left afterwards.

• Working: every treatment has a named owner and a date, and someone checks it was done.
• Warning sign: the action plan says “monitor” against every risk.

5. Monitoring and review, all the way through. Checking regularly whether the risks, the controls and the process itself are still right, because things change.

• Working: key risk indicators warn you early, and the register is updated when something changes, not only once a year.
• Warning sign: a risk materialises that was rated “low” two years ago and never looked at again.

6. Recording and reporting, all the way through. Writing down what was found and decided, and reporting it to the people who need it, in a form they can use.

• Working: the board gets a short, clear report that leads to decisions.
• Warning sign: a 60-page risk report that nobody reads.

A worked example

The club is thinking of signing an expensive striker.

• Scope, context and criteria: the objective is promotion this season without breaking the wage budget. The board’s appetite: no single signing above 15% of the wage bill.
• Identify: injury, poor fit with the team, the wage bill crowding out other players, and the opportunity of more goals and ticket sales.
• Analyse: his injury history makes a long layoff fairly likely; the cost would be a big share of the budget.
• Evaluate: the injury risk is above what the board accepts.
• Treat: a full medical, a performance-linked contract and injury insurance bring it within appetite.
• Around it all: the coach and medical staff are consulted, the board receives a one-page report, and the risk is checked again at the January transfer window.

The South African angle

The IRMSA Risk Report 2026/27 describes South Africa’s biggest risks as a long emergency: old risks that keep coming back and feed each other. For the process, that means two things. First, identification and analysis must look across silos, because one risk can trigger another. Second, a once-a-year assessment isn’t enough: monitoring and review has to be continuous, so the organisation notices when a familiar risk changes shape.

Process check

Score your organisation from 1 (not at all) to 5 (always) on each step: communication and consultation; scope, context and criteria; risk assessment; risk treatment; monitoring and review; and recording and reporting. Start with your lowest score. In many organisations it’s treatment: risks are assessed carefully, but the actions never quite happen.

Key takeaways

• The process is the part of ISO 31000 people actually do, for any decision, project or organisation.
• The core is scope, context and criteria, then risk assessment (identify, analyse, evaluate), then treatment.
• Communication and consultation, monitoring and review, and recording and reporting run all the way through.
• A process is only working if it changes decisions and the agreed actions get done.

Think about it

1. Who should you consult before you next assess a risk in your area?
2. Are your risk ratings linked to a stated risk appetite?
3. Pick one treatment action from your risk register. Who owns it, and is it done?

This lesson explains ISO 31000:2018 in our own words and does not reproduce the standard.